Thelia EUVD-2026-114745

Requires an authenticated back-office administrator with store update permission (PR:H) who reaches Configuration → Store, where the logo_file and banner_file fields accept image/svg+xml via a bare new Image() constraint and are the only upload path that skips FileProcessorService::sanitizeUpload(), so the SVG's onload/script content is stored intact. Exploitation also needs victim interaction (UI:A): a higher-privileged admin must load /admin/store-media/logo in an authenticated session, or any visitor/crawler must fetch the public cache/images/store/<uniqid>-logo.svg URL that every front-office page's og:image meta publishes. Limiting factors: the high-privilege prerequisite for planting the payload confines the initial step to trusted or compromised operator accounts; the public reach depends on the core image cache mirroring the original into the document root, which the advisory states occurs in both supported original_image_delivery_mode settings. Per the vendor fix, updating to 3.1.1 (and back-office default-twig template 1.1.1) is the remediation.

This is a genuine but constrained stored-XSS issue rather than a drop-everything emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A) scores 4.6 (medium), and the key limiter is PR:H - exploitation requires an authenticated back-office administrator holding store update permission to plant the payload, so the initial write is a privileged/insider or compromised-admin action, not a remote-unauthenticated one. What raises this above a typical self-XSS is the delivery side confirmed by the GHSA source-code analysis: the malicious SVG is mirrored by the core image cache into the document root and advertised in every front-office page's og:image meta, giving the payload anonymous public reachability (no session needed) plus admin-origin execution via /admin/store-media/logo, which can be chained to CSRF-token theft and back-office mutations against higher-privileged admins. Signals are mostly consistent: the vulnerability is patched (3.1.1), VulnCheck is the reporter, and the GHSA advisory carries a detailed PoC. However, there is NO EPSS score in the input and the CVE is NOT listed in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_month', indicating scheduled remediation rather than emergency patching. Net: prioritize patching this cycle, weighted by whether the shop grants store-update permission beyond fully trusted operators.

An attacker who controls or compromises a back-office admin account with store update permission uploads a store logo or banner as an SVG containing an onload JavaScript payload, which bypasses Thelia's SVG sanitizer and is stored unmodified. The file is then served as image/svg+xml both at /admin/store-media/logo (executing in a viewing administrator's authenticated session) and, mirrored into public/cache/images/store/, via the og:image meta printed on every front-office page, so any anonymous visitor or crawler that navigates to that URL triggers script execution on the shop origin. The GHSA advisory includes a step-by-step proof-of-concept with a working alert(document.domain) SVG payload.